{ "$schema": "https://ui.shadcn.com/schema/registry-item.json", "name": "vulnerability-scanner-report", "title": "Vulnerability Scanner Report", "type": "registry:block", "files": [ { "path": "packages/registry-react/blocks/vulnerability-scanner-report/VulnerabilityScannerReport.tsx", "content": "'use client'\n\nimport * as React from 'react'\nimport {\n AlertCircle,\n AlertTriangle,\n Check,\n CheckCircle2,\n Copy,\n Download,\n ExternalLink,\n FileCode2,\n GitPullRequest,\n Info,\n Package,\n RefreshCw,\n Search,\n ShieldAlert,\n ShieldCheck,\n} from 'lucide-react'\nimport { cn } from '@/lib/utils'\nimport { Badge } from '@/components/ui/badge'\nimport { Button } from '@/components/ui/button'\nimport { Card, CardContent } from '@/components/ui/card'\nimport { Input } from '@/components/ui/input'\nimport { Progress } from '@/components/ui/progress'\nimport { Select, SelectContent, SelectItem, SelectTrigger, SelectValue } from '@/components/ui/select'\nimport {\n Sheet,\n SheetClose,\n SheetContent,\n SheetDescription,\n SheetFooter,\n SheetHeader,\n SheetTitle,\n} from '@/components/ui/sheet'\nimport { Table, TableBody, TableCell, TableHead, TableHeader, TableRow } from '@/components/ui/table'\n\nexport type CveSeverity = 'critical' | 'high' | 'medium' | 'low'\nexport type ExploitStatus = 'poc' | 'none'\n\nexport interface CveItem {\n id: string\n title: string\n cwe: string\n severity: CveSeverity\n cvssScore: number\n cvssVector: string\n pkgName: string\n installedVersion: string\n fixedVersion: string\n exploitStatus: ExploitStatus\n exploitLabel: string\n attackVector: string\n attackComplexity: string\n privilegesRequired: string\n userInteraction: string\n description: string\n impact: string\n remediationDiff: {\n removed: string\n added: string\n }\n patchCommand: string\n advisoryUrl: string\n}\n\nexport interface VulnerabilityScannerReportProps {\n targetRepo?: string\n targetBranch?: string\n baseImage?: string\n lastScanned?: string\n grade?: string\n gradeSummary?: string\n totalDeps?: number\n items?: CveItem[]\n className?: string\n}\n\nconst defaultCveItems: CveItem[] = [\n {\n id: 'CVE-2026-38419',\n title: 'Prototype Pollution via mergeCustomizer in lodash',\n cwe: 'CWE-1321',\n severity: 'high',\n cvssScore: 8.4,\n cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N',\n pkgName: 'lodash',\n installedVersion: '4.17.20',\n fixedVersion: '4.17.22+',\n exploitStatus: 'poc',\n exploitLabel: 'Proof of Concept available',\n attackVector: 'Network (Remote)',\n attackComplexity: 'Low',\n privilegesRequired: 'None',\n userInteraction: 'None',\n description:\n 'A prototype pollution vulnerability in lodash prior to 4.17.22 allows unauthenticated remote attackers to modify Object.prototype properties via crafted JSON payloads, leading to denial of service or potential remote code execution.',\n impact: 'Critical data integrity failure and property tampering across server runtime objects.',\n remediationDiff: {\n removed: ' \"lodash\": \"^4.17.20\",',\n added: ' \"lodash\": \"^4.17.22\",',\n },\n patchCommand: 'npm install lodash@^4.17.22 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-38419',\n },\n {\n id: 'CVE-2026-29401',\n title: 'Server-Side Request Forgery (SSRF) bypass in axios redirect handler',\n cwe: 'CWE-918',\n severity: 'high',\n cvssScore: 7.8,\n cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N',\n pkgName: 'axios',\n installedVersion: '1.6.2',\n fixedVersion: '1.7.9+',\n exploitStatus: 'poc',\n exploitLabel: 'Proof of Concept available',\n attackVector: 'Network (Remote)',\n attackComplexity: 'Low',\n privilegesRequired: 'None',\n userInteraction: 'Required',\n description:\n 'Axios versions <=1.6.8 improperly preserve sensitive Authorization and Cookie headers during cross-origin HTTP 302/307 redirects, exposing upstream credentials to untrusted third-party endpoints.',\n impact: 'Authorization bearer token leakage to arbitrary redirect targets.',\n remediationDiff: {\n removed: ' \"axios\": \"^1.6.2\",',\n added: ' \"axios\": \"^1.7.9\",',\n },\n patchCommand: 'npm install axios@^1.7.9 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-29401',\n },\n {\n id: 'CVE-2026-10492',\n title: 'Arbitrary File Overwrite via hardlink traversal in tar',\n cwe: 'CWE-59',\n severity: 'medium',\n cvssScore: 6.5,\n cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H',\n pkgName: 'tar',\n installedVersion: '6.1.11',\n fixedVersion: '6.2.1+',\n exploitStatus: 'none',\n exploitLabel: 'No known exploit',\n attackVector: 'Local Archive Extraction',\n attackComplexity: 'Low',\n privilegesRequired: 'None',\n userInteraction: 'Required',\n description:\n 'The tar package before 6.2.1 is vulnerable to arbitrary file write outside the extraction destination directory when untrusted tar archives contain hardlinks pointing to symlinked directories.',\n impact: 'Arbitrary filesystem overwrite upon unpacking unvetted tarball artifacts.',\n remediationDiff: {\n removed: ' \"tar\": \"^6.1.11\",',\n added: ' \"tar\": \"^6.2.1\",',\n },\n patchCommand: 'npm install tar@^6.2.1 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-10492',\n },\n {\n id: 'CVE-2026-84920',\n title: 'Signature verification bypass via algorithm confusion in jsonwebtoken',\n cwe: 'CWE-347',\n severity: 'medium',\n cvssScore: 6.1,\n cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N',\n pkgName: 'jsonwebtoken',\n installedVersion: '8.5.1',\n fixedVersion: '9.0.2+',\n exploitStatus: 'poc',\n exploitLabel: 'Proof of Concept available',\n attackVector: 'Network (Remote)',\n attackComplexity: 'High',\n privilegesRequired: 'None',\n userInteraction: 'None',\n description:\n 'When jwt.verify() is executed without explicit algorithms whitelisting, attackers can forge unsigned tokens or switch asymmetric RS256 keys to symmetric HMAC evaluation with public certs.',\n impact: 'Unauthorized identity impersonation and claim forgery.',\n remediationDiff: {\n removed: ' \"jsonwebtoken\": \"^8.5.1\",',\n added: ' \"jsonwebtoken\": \"^9.0.2\",',\n },\n patchCommand: 'npm install jsonwebtoken@^9.0.2 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84920',\n },\n {\n id: 'CVE-2026-18933',\n title: 'Regular Expression Denial of Service (ReDoS) in micromatch',\n cwe: 'CWE-1333',\n severity: 'medium',\n cvssScore: 5.3,\n cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L',\n pkgName: 'micromatch',\n installedVersion: '4.0.5',\n fixedVersion: '4.0.8+',\n exploitStatus: 'none',\n exploitLabel: 'No known exploit',\n attackVector: 'Network (Remote)',\n attackComplexity: 'Low',\n privilegesRequired: 'None',\n userInteraction: 'None',\n description:\n 'A backtracking exponential regular expression in micromatch path globbing allows attackers sending crafted nested brace expressions to cause catastrophic CPU exhaustion and event loop freeze.',\n impact: 'Node.js main thread event-loop starvation and service unresponsiveness.',\n remediationDiff: {\n removed: ' \"micromatch\": \"^4.0.5\",',\n added: ' \"micromatch\": \"^4.0.8\",',\n },\n patchCommand: 'npm install micromatch@^4.0.8 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-18933',\n },\n {\n id: 'CVE-2026-04192',\n title: 'Information disclosure in child process error serialization in cross-spawn',\n cwe: 'CWE-209',\n severity: 'low',\n cvssScore: 3.7,\n cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N',\n pkgName: 'cross-spawn',\n installedVersion: '7.0.3',\n fixedVersion: '7.0.6+',\n exploitStatus: 'none',\n exploitLabel: 'No known exploit',\n attackVector: 'Local Environment',\n attackComplexity: 'High',\n privilegesRequired: 'Low',\n userInteraction: 'None',\n description:\n 'Under verbose debug logging configurations, command environment variables containing auth tokens may be included in uncaught spawn error stacks printed to stdout.',\n impact: 'Accidental leakage of process environment credentials in CI runner logs.',\n remediationDiff: {\n removed: ' \"cross-spawn\": \"^7.0.3\",',\n added: ' \"cross-spawn\": \"^7.0.6\",',\n },\n patchCommand: 'npm install cross-spawn@^7.0.6 --save-exact',\n advisoryUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-04192',\n },\n]\n\nexport function VulnerabilityScannerReport({\n targetRepo = 'uipkge / core-registry:v2.4',\n targetBranch = 'main (git:a4f891b)',\n baseImage = 'node:22-alpine3.20',\n lastScanned = 'Scanned 12m ago via Trivy v0.52',\n grade = 'Grade B+',\n gradeSummary = '2 High CVEs',\n totalDeps = 1284,\n items = defaultCveItems,\n className,\n}: VulnerabilityScannerReportProps) {\n const [searchQuery, setSearchQuery] = React.useState('')\n const [severityFilter, setSeverityFilter] = React.useState('all')\n const [exploitFilter, setExploitFilter] = React.useState('all')\n const [isScanning, setIsScanning] = React.useState(false)\n const [scanProgress, setScanProgress] = React.useState(100)\n const [currentLastScanned, setCurrentLastScanned] = React.useState(lastScanned)\n const [selectedCve, setSelectedCve] = React.useState(null)\n const [isDrawerOpen, setIsDrawerOpen] = React.useState(false)\n const [copiedCveId, setCopiedCveId] = React.useState(null)\n const [fixedPrs, setFixedPrs] = React.useState>({})\n const [exportSuccess, setExportSuccess] = React.useState(false)\n\n const summaryCounts = React.useMemo(() => {\n return {\n critical: items.filter((i) => i.severity === 'critical').length,\n high: items.filter((i) => i.severity === 'high').length,\n medium: 5,\n low: 12,\n total: items.length,\n }\n }, [items])\n\n const filteredItems = React.useMemo(() => {\n const query = searchQuery.trim().toLowerCase()\n return items.filter((item) => {\n const matchesSeverity = severityFilter === 'all' || item.severity === severityFilter\n const matchesExploit = exploitFilter === 'all' || item.exploitStatus === exploitFilter\n const matchesSearch =\n !query ||\n item.id.toLowerCase().includes(query) ||\n item.pkgName.toLowerCase().includes(query) ||\n item.title.toLowerCase().includes(query) ||\n item.cwe.toLowerCase().includes(query)\n\n return matchesSeverity && matchesExploit && matchesSearch\n })\n }, [items, searchQuery, severityFilter, exploitFilter])\n\n const triggerRescan = React.useCallback(() => {\n if (isScanning) return\n setIsScanning(true)\n setScanProgress(15)\n\n const interval = setInterval(() => {\n setScanProgress((prev) => (prev < 90 ? prev + 25 : prev))\n }, 150)\n\n setTimeout(() => {\n clearInterval(interval)\n setScanProgress(100)\n setIsScanning(false)\n setCurrentLastScanned('Scanned just now via Trivy v0.52')\n }, 800)\n }, [isScanning])\n\n const openAdvisory = React.useCallback((cve: CveItem) => {\n setSelectedCve(cve)\n setIsDrawerOpen(true)\n }, [])\n\n const handleAutoFix = React.useCallback((cveId: string) => {\n setFixedPrs((prev) => ({ ...prev, [cveId]: true }))\n }, [])\n\n const copyCommand = React.useCallback((cveId: string, command: string) => {\n if (typeof navigator !== 'undefined' && navigator.clipboard) {\n navigator.clipboard.writeText(command)\n setCopiedCveId(cveId)\n setTimeout(() => {\n setCopiedCveId((curr) => (curr === cveId ? null : curr))\n }, 2000)\n }\n }, [])\n\n const exportSbom = React.useCallback(() => {\n const sbomData = {\n spdxVersion: 'SPDX-2.3',\n dataLicense: 'CC0-1.0',\n SPDXID: 'SPDXRef-DOCUMENT',\n name: 'uipkge-core-registry-sbom',\n documentNamespace: 'https://uipkge.dev/spdxdocs/core-registry-v2.4',\n creationInfo: {\n created: new Date().toISOString(),\n creators: ['Tool: Trivy-v0.52', 'Organization: UIPKGE Security Squad'],\n },\n packages: items.map((item) => ({\n name: item.pkgName,\n SPDXID: `SPDXRef-Package-${item.pkgName}`,\n versionInfo: item.installedVersion,\n downloadLocation: `https://registry.npmjs.org/${item.pkgName}/-/${item.pkgName}-${item.installedVersion}.tgz`,\n filesAnalyzed: false,\n securityVulnerabilities: [\n {\n id: item.id,\n severity: item.severity.toUpperCase(),\n cvssScore: item.cvssScore,\n remediation: item.fixedVersion,\n },\n ],\n })),\n }\n\n const jsonStr = 'data:text/json;charset=utf-8,' + encodeURIComponent(JSON.stringify(sbomData, null, 2))\n if (typeof document !== 'undefined') {\n const downloadAnchor = document.createElement('a')\n downloadAnchor.setAttribute('href', jsonStr)\n downloadAnchor.setAttribute('download', `sbom-spdx-core-registry-${new Date().toISOString().slice(0, 10)}.json`)\n document.body.appendChild(downloadAnchor)\n downloadAnchor.click()\n downloadAnchor.remove()\n\n setExportSuccess(true)\n setTimeout(() => {\n setExportSuccess(false)\n }, 2000)\n }\n }, [items])\n\n const toggleSeverityFilter = React.useCallback((sev: string) => {\n setSeverityFilter((prev) => (prev === sev ? 'all' : sev))\n }, [])\n\n return (\n
\n {/* Header Section */}\n
\n
\n
\n
\n \n
\n
\n
\n

{targetRepo}

\n \n \n {grade} · {gradeSummary}\n \n
\n
\n {currentLastScanned}\n ·\n {targetBranch}\n ·\n {baseImage}\n ·\n {totalDeps.toLocaleString()} dependencies audited\n
\n
\n
\n
\n\n
\n \n {exportSuccess ? : }\n {exportSuccess ? 'SBOM Exported' : 'Export SBOM (SPDX)'}\n \n\n \n \n {isScanning ? 'Scanning Container...' : 'Trigger Re-scan'}\n \n
\n
\n\n {/* Active Scan Progress Track */}\n {isScanning && (\n
\n
\n \n \n Running AST & SBOM vulnerability correlation against NVD & OSV databases...\n \n {scanProgress}%\n
\n \n
\n )}\n\n {/* 4 CVE Severity Summary Cards */}\n
\n {/* Critical Card */}\n toggleSeverityFilter('critical')}\n >\n \n
\n
\n

Critical Severity

\n
\n \n {summaryCounts.critical}\n \n 0 CVEs\n
\n
\n
\n \n
\n
\n
\n Zero critical exposures\n CVSS 9.0–10.0\n
\n \n \n\n {/* High Card */}\n toggleSeverityFilter('high')}\n >\n \n
\n
\n

High Severity

\n
\n \n {summaryCounts.high}\n \n 2 CVEs\n
\n
\n
\n \n
\n
\n
\n Actionable patches ready\n CVSS 7.0–8.9\n
\n \n \n\n {/* Medium Card */}\n toggleSeverityFilter('medium')}\n >\n \n
\n
\n

Medium Severity

\n
\n \n {summaryCounts.medium}\n \n 5 CVEs\n
\n
\n
\n \n
\n
\n
\n 3 in direct dependencies\n CVSS 4.0–6.9\n
\n \n \n\n {/* Low Card */}\n toggleSeverityFilter('low')}\n >\n \n
\n
\n

Low Severity

\n
\n \n {summaryCounts.low}\n \n 12 CVEs\n
\n
\n
\n \n
\n
\n
\n Informational & debug\n CVSS 0.1–3.9\n
\n \n \n
\n\n {/* Filter & Search Toolbar */}\n
\n
\n
\n \n setSearchQuery(e.target.value)}\n placeholder=\"Search CVE, package, or CWE...\"\n className=\"h-8 pl-8 text-xs\"\n />\n
\n\n {/* Severity Filter Select */}\n \n\n {/* Exploitability Filter Select */}\n \n\n {(severityFilter !== 'all' || exploitFilter !== 'all' || searchQuery) && (\n {\n setSeverityFilter('all')\n setExploitFilter('all')\n setSearchQuery('')\n }}\n >\n Reset filters\n \n )}\n
\n\n
\n \n Showing {filteredItems.length} of {items.length}{' '}\n audited vulnerabilities\n \n
\n
\n\n {/* Vulnerability Table Card */}\n \n
\n \n \n \n Vulnerability / CVE\n Severity\n Affected Package\n Remediation Fixed\n Exploitability\n Actions\n \n \n \n {filteredItems.map((item) => (\n openAdvisory(item)}\n >\n {/* Vulnerability / CVE */}\n \n
\n
\n \n {item.id}\n \n \n {item.cwe}\n \n
\n

{item.title}

\n
\n \n\n {/* Severity & CVSS Score */}\n \n
\n {item.severity === 'critical' ? (\n \n \n CVSS {item.cvssScore} Critical\n \n ) : item.severity === 'high' ? (\n \n \n CVSS {item.cvssScore} High\n \n ) : item.severity === 'medium' ? (\n \n \n CVSS {item.cvssScore} Med\n \n ) : (\n \n \n CVSS {item.cvssScore} Low\n \n )}\n

v3.1 Vector

\n
\n \n\n {/* Affected Package & Version */}\n \n
\n \n
\n

{item.pkgName}

\n

v{item.installedVersion}

\n
\n
\n \n\n {/* Remediation Fixed Version */}\n \n
\n
\n \n {item.fixedVersion}\n
\n

Upgrade ready

\n
\n \n\n {/* Exploitability Status */}\n \n
\n \n \n {item.exploitLabel}\n \n
\n \n\n {/* Row Action Buttons */}\n e.stopPropagation()}>\n
\n openAdvisory(item)}\n >\n View Advisory\n \n\n {!fixedPrs[item.id] ? (\n handleAutoFix(item.id)}\n >\n \n Auto-Fix PR\n \n ) : (\n \n \n PR #849 Opened\n \n )}\n
\n \n \n ))}\n\n {filteredItems.length === 0 && (\n \n \n
\n \n

No matching vulnerabilities found

\n

\n All packages satisfy the active filter constraints.\n

\n
\n \n \n )}\n \n
\n
\n\n {/* Table Footer Metadata */}\n
\n
\n \n \n NVD Sync Live\n \n ·\n CVSS Score Engine: v3.1 Specification\n
\n
\n Target hash: 9a20bf183\n
\n
\n \n\n {/* Detailed CVE Advisory Drawer / Sheet */}\n \n \n {selectedCve && (\n <>\n \n
\n
\n {selectedCve.severity === 'critical' ? (\n \n CRITICAL {selectedCve.cvssScore}\n \n ) : selectedCve.severity === 'high' ? (\n \n HIGH {selectedCve.cvssScore}\n \n ) : selectedCve.severity === 'medium' ? (\n \n MEDIUM {selectedCve.cvssScore}\n \n ) : (\n \n LOW {selectedCve.cvssScore}\n \n )}\n\n \n {selectedCve.cwe}\n \n
\n\n \n NVD Source\n \n \n
\n\n {selectedCve.id}\n \n {selectedCve.title}\n \n \n\n
\n {/* CVSS 3.1 Metrics Grid */}\n
\n
\n CVSS v3.1 Base Score\n {selectedCve.cvssScore} / 10.0\n
\n \n\n
\n
\n

Attack Vector

\n

{selectedCve.attackVector}

\n
\n
\n

Complexity

\n

{selectedCve.attackComplexity}

\n
\n
\n

Privileges

\n

{selectedCve.privilegesRequired}

\n
\n
\n

Interaction

\n

{selectedCve.userInteraction}

\n
\n
\n\n {/* CVSS Vector String */}\n
\n {selectedCve.cvssVector}\n
\n
\n\n {/* Description & Technical Impact */}\n
\n

\n Vulnerability Overview\n

\n

{selectedCve.description}

\n
\n\n
\n

\n Technical Impact\n

\n
\n {selectedCve.impact}\n
\n
\n\n {/* Package Path & Version Comparison */}\n
\n

\n Dependency State\n

\n
\n
\n

Installed Version

\n

\n {selectedCve.pkgName}@{selectedCve.installedVersion}\n

\n

Direct dependency in package.json

\n
\n\n
\n

Remediation Target

\n

\n {selectedCve.pkgName}@{selectedCve.fixedVersion}\n

\n

Non-breaking patch update

\n
\n
\n
\n\n {/* Remediation Code Diff */}\n
\n
\n

\n package.json Patch Diff\n

\n package.json\n
\n
\n
\n \n dependencies\n
\n
\n
\n - {selectedCve.remediationDiff.removed}\n
\n
\n + {selectedCve.remediationDiff.added}\n
\n
\n
\n
\n\n {/* Remediation CLI Command Box */}\n
\n
\n

\n CLI Remediation Command\n

\n copyCommand(selectedCve.id, selectedCve.patchCommand)}\n >\n {copiedCveId === selectedCve.id ? (\n \n ) : (\n \n )}\n {copiedCveId === selectedCve.id ? 'Copied' : 'Copy command'}\n \n
\n
\n {selectedCve.patchCommand}\n
\n
\n
\n\n \n \n \n \n\n {!fixedPrs[selectedCve.id] ? (\n handleAutoFix(selectedCve.id)}\n >\n \n Open Auto-Fix Pull Request\n \n ) : (\n \n \n PR #849 Created & Assigned\n \n )}\n \n \n )}\n \n \n
\n )\n}\n", "type": "registry:block", "target": "~/components/blocks/VulnerabilityScannerReport.tsx" } ], "dependencies": [ "lucide-react" ], "devDependencies": [], "registryDependencies": [ "https://uipkge.dev/r/react/badge.json", "https://uipkge.dev/r/react/button.json", "https://uipkge.dev/r/react/card.json", "https://uipkge.dev/r/react/input.json", "https://uipkge.dev/r/react/progress.json", "https://uipkge.dev/r/react/select.json", "https://uipkge.dev/r/react/sheet.json", "https://uipkge.dev/r/react/table.json" ], "description": "Snyk and Trivy style CVE vulnerability scanner report and dependency security audit with severity breakdown cards, CVSS metrics, package version diffs, advisory inspection drawer, and automated remediation PR actions.", "categories": [ "security", "dashboard", "devops" ] }